[ci] Pin CI Node.js to node-fetch@2-safe versions (22.23.1 / 24.18.0)

[petebacondarwin]

Node 22.23.0 and 24.17.0 shipped a security backport that regressed node-fetch@2 keep-alive responses, causing spurious ERR_STREAM_PREMATURE_CLOSE errors (nodejs/node#63989, fixed by nodejs/node#64004 in 22.23.1 / 24.18.0). This was already flaking the Handle Changesets job (ERR_STREAM_PREMATURE_CLOSE during publish/deploy).

#14476 pinned only the Wrangler E2E workflow. This rolls the pin out across the rest of CI, pinning to the node-fetch@2-safe patch releases:

• install-dependencies action: default node-version 22 → 22.23.1 (fixes every workflow that uses the default in one place, including the C3 E2E and main test jobs).
• changesets.yml: build/publish install 24 → 24.18.0, and the non-npm-deploy Node switch 22 → 22.23.1.
• test-and-check-other-node.yml: matrix Node 24 → 24.18.0 (kept description: "Node 24" so the required-check name stays stable; 25 left as-is).
• e2e-wrangler.yml: removed the now-redundant explicit 22.23.1 pin — it inherits the shared default.

Left intentionally unpinned: Node 20 in test-and-check.yml (old-Node error-message check, no HTTP) and Node 25 in the other-node matrix (bleeding-edge canary).

These pins should be floated back to 22 / 24 once the runners' default resolution is safely past the regressed patches.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because: this only changes CI workflow/action Node.js version pins (no product or library code) — the change is exercised by CI itself running on the pinned versions.
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: internal CI-only configuration change with no user-facing impact.

---

[changeset-bot]

⚠️ No Changeset found

Latest commit: b1422b3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[ask-bonk]

All of these use install-dependencies without an explicit node-version, so they inherit the new pinned 22.23.1 default. This confirms the PR's claim that pinning the default fixes them all in one place. The prerelease.yml and hotfix-release.yml (which do npm publishing over HTTP) now correctly get the safe version.

The changes are internally consistent, correct, and complete:

• All floating 22/24 versions in HTTP-affected publish/deploy paths are now pinned to safe versions.
• The default-based inheritance correctly covers all the other workflows.
• The matrix description: "Node 24" is preserved, keeping the required-check name stable.
• Intentionally-unpinned versions (Node 20 no-HTTP check, Node 25 canary) are documented.
• YAML parses 22.23.1/24.18.0 as strings, which setup-node accepts.
• Comments clearly document the rationale and float-back plan.

No logic bugs, security issues, or backward-compatibility problems found.

LGTM

github run

[devin-ai-integration]

Devin Review found 1 potential issue.

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@14523

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@14523

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@14523

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@14523

miniflare

npm i https://pkg.pr.new/miniflare@14523

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@14523

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@14523

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@14523

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@14523

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@14523

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@14523

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@14523

wrangler

npm i https://pkg.pr.new/wrangler@14523

commit: b1422b3

[workers-devprod]

Codeowners reviews satisfied